fix: address code review findings

- Add max_length=100 on BulkStatusRequest.room_names to prevent abuse
- Filter bulk endpoint results to rooms user can see (owned or shared)
- Throw on bulk-status fetch error instead of silently returning empty data
- Fix room_by_id type annotation: dict[str, DbRoom] instead of Any
- Remove stale "200ms" comment in test
- Enable strict: true in jest tsconfig
- Remove working docs from tracked files
- Simplify redundant ternary in test helper

www/app/lib/meetingStatusBatcher.ts

@@ -14,13 +14,19 @@ export function createMeetingStatusBatcher(windowMs: number = BATCH_WINDOW_MS) {
   return create({
     fetcher: async (roomNames: string[]): Promise<MeetingStatusResult[]> => {
       const unique = [...new Set(roomNames)];
-      const { data } = await client.POST("/v1/rooms/meetings/bulk-status", {
-        body: { room_names: unique },
-      });
+      const { data, error } = await client.POST(
+        "/v1/rooms/meetings/bulk-status",
+        { body: { room_names: unique } },
+      );
+      if (error || !data) {
+        throw new Error(
+          `bulk-status fetch failed: ${JSON.stringify(error ?? "no data")}`,
+        );
+      }
       return roomNames.map((name) => ({
         roomName: name,
-        active_meetings: data?.[name]?.active_meetings ?? [],
-        upcoming_events: data?.[name]?.upcoming_events ?? [],
+        active_meetings: data[name]?.active_meetings ?? [],
+        upcoming_events: data[name]?.upcoming_events ?? [],
       }));
     },
     resolver: keyResolver("roomName"),